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What is claimed is : 

1. A method for detecting intrusion in a database managed by an access 
control system, comprising: 

defining at least one intrusion detection profile, each including at least one 
item access rate; 

associating each user with one of said defined profiles; 
receiving a query from a user; 

determining whether a result of said query exceeds any one of the item access 
rates defined in the profile associated with the user; and 

notifying the access control system, upon determining that the result exceeds 
any one of the at least one item access rates defined in the associated profile, to alter 
user authorization, thereby making the received requested query an unauthorized 
request, before the result of the query is transmitted to the user. 

2. The method of claim 1 , further comprising: 
accumulating results from performed queries in a record; and 
determining whether the accumulated results exceed any one of said at 

least one item access rate. 

3. The method of claim 1 , wherein items subject to item access rates are 
marked in the database, and wherein any query concerning said items automatically 
trigger the intrusion detection. 

4. The method of claim 3, wherein the step of determining whether an 
item access rate is exceeded includes determining if the query result includes rows 
from marked items, and proceeding with the intrusion detection process only upon 
determining that the item access rate is exceeded. 

5. The method of claim 1, wherein one of said at least one item access 
rates defines the ntimber of rows a user may access from a database item at one time. 

6. The method of claim 1, wherein one of said at least on item access 
rates defines the number of rows a group of users may access from a database item at 
one time. 

7. The method of claim 1, wherein one of said at least on item access 
rates defines the number of rows that may be accessed from a database item over a 
period of time. 

8. The method of claim 1, wherein one of said at least on item access 
rates defines the number of rows a group of users may access from a database item 
over a period of time. 

9. The method of claim 1, wherein the intrusion detection policy further 
includes at least one inference pattern, the method further comprising: 
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accumulating results from performed queries in a record; 

comparing said record with at least one of said inference patterns, in 
order to determine whether a combination of accesses in said record match said 
inference policy; and 

notifying the access control system, upon determining that a 
combination of accesses in the record match said inference policy, to alter the user 
authorization, thereby making the received request an unauthorized request, before 
said result is transmitted to the user. 

10. The method of claim 2, wherein items subject to item access rates are 
marked in the database, and wherein any query concerning said items automatically 
trigger the intrusion detection. 

11. The method of claim 10, wherein the step of determining whether an 
item access rate is exceeded includes determining if the query result includes rows 
from marked items, and proceeding with the intrusion detection process only upon 
determining that the item access rate is exceeded. 
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